Sigma detection rules, expert-reviewed

Malicious Privileged Container Creation in Kubernetes (via audit)

This rule detects a Kubernetes API request that creates a pod with a privileged security context, which grants the container near-host capabilities and is a primary path for escaping to the underlying node. Container escape and privileged workloads are emerging techniques in the Red Canary Threat Detection Report as adversaries target cloud-native environments. Detecting privileged pod creation surfaces a high-risk configuration that enables host compromise.

Malicious Cluster-Admin Role Binding Creation (via audit)

This rule detects creation of a ClusterRoleBinding or RoleBinding, which can grant an attacker cluster-admin privileges over a Kubernetes cluster, a privilege-escalation and persistence technique in cloud-native environments. Abusive role binding is tracked in the Red Canary Threat Detection Report cloud coverage. Detecting these requests surfaces an attempt to entrench elevated access.

Suspicious Command Execution Inside a Kubernetes Pod (via audit)

This rule detects a create request against the pods/exec subresource, which opens an interactive shell inside a running container, a technique attackers use for hands-on-keyboard access to a Kubernetes workload. Exec into pod is tracked in the Red Canary Threat Detection Report cloud coverage. Detecting these requests surfaces interactive access to container workloads.

Suspicious Kubernetes API Request From Anonymous User

This rule detects Kubernetes API server requests authenticated as the anonymous or unauthenticated system identity which indicates an unauthenticated actor probing the cluster control plane as described in NCC Group Kubernetes detection engineering research. Adversaries leverage anonymous access to enumerate resources and stage container escapes so any such request warrants investigation.

Suspicious Anonymous Access to Kubernetes API Server via Audit Log

This rule detects Kubernetes API server requests authenticated as system:anonymous or belonging to the system:unauthenticated group. Adversaries query an unauthenticated API server to enumerate pods, secrets, and other cluster resources for reconnaissance and initial access. Anonymous access to the control plane indicates a misconfigured cluster exposed to untrusted callers.

Suspicious Shell Execution Into Kubernetes Pod via API

This rule detects Kubernetes API exec subresource requests whose request URI invokes an interactive shell such as bin bash or bin sh inside a running pod as described in NCC Group Kubernetes detection engineering research. Adversaries abuse pod exec to gain interactive access to containers for reconnaissance and lateral movement so unexpected shell sessions should be reviewed.